[PATCH] lib: vsprintf: fix invalid arg check

[PATCH] lib: vsprintf: fix invalid arg check

[Vasiliy Kulikov]

"size" is size_t.  If we want to check whether it was underflowed
then we should cast it to ssize_t instead of int.  When
sizeof(size_t) > sizeof(int) the code sees UINT_MAX as underflow,
but it is not.

Signed-off-by: Vasiliy Kulikov <segooon@gmail.com>
---
 Compile tested.

 lib/vsprintf.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/lib/vsprintf.c b/lib/vsprintf.c
index c150d3d..e7cf674 100644
--- a/lib/vsprintf.c
+++ b/lib/vsprintf.c
@@ -1290,7 +1290,7 @@ int vsnprintf(char *buf, size_t size, const char *fmt, va_list args)
 
 	/* Reject out-of-range values early.  Large positive sizes are
 	   used for unknown buffer sizes. */
-	if (WARN_ON_ONCE((int) size < 0))
+	if (WARN_ON_ONCE((ssize_t) size < 0))
 		return 0;
 
 	str = buf;
-- 
1.7.0.4

Re: [PATCH] lib: vsprintf: fix invalid arg check

[Andrew Morton]

On Wed, 10 Nov 2010 23:38:08 +0300
Vasiliy Kulikov <segooon@gmail.com> wrote:

> "size" is size_t.  If we want to check whether it was underflowed
> then we should cast it to ssize_t instead of int.  When
> sizeof(size_t) > sizeof(int) the code sees UINT_MAX as underflow,
> but it is not.
> 

Does this patch fix any actual observed problem?

>  Compile tested.
> 

I guess not.

> --- a/lib/vsprintf.c
> +++ b/lib/vsprintf.c
> @@ -1290,7 +1290,7 @@ int vsnprintf(char *buf, size_t size, const char *fmt, va_list args)
>  
>  	/* Reject out-of-range values early.  Large positive sizes are
>  	   used for unknown buffer sizes. */

Thousands of people would find that comment to be utterly mysterious. 
I am one.

> -	if (WARN_ON_ONCE((int) size < 0))
> +	if (WARN_ON_ONCE((ssize_t) size < 0))
>  		return 0;
>  
>  	str = buf;

Re: [PATCH] lib: vsprintf: fix invalid arg check

[David Rientjes]

On Wed, 10 Nov 2010, Andrew Morton wrote:

> > "size" is size_t.  If we want to check whether it was underflowed
> > then we should cast it to ssize_t instead of int.  When
> > sizeof(size_t) > sizeof(int) the code sees UINT_MAX as underflow,
> > but it is not.
> > 
> 
> Does this patch fix any actual observed problem?
> 
> >  Compile tested.
> > 
> 
> I guess not.
> 
> > --- a/lib/vsprintf.c
> > +++ b/lib/vsprintf.c
> > @@ -1290,7 +1290,7 @@ int vsnprintf(char *buf, size_t size, const char *fmt, va_list args)
> >  
> >  	/* Reject out-of-range values early.  Large positive sizes are
> >  	   used for unknown buffer sizes. */
> 
> Thousands of people would find that comment to be utterly mysterious. 
> I am one.
> 

vsprintf() and sprintf() pass INT_MAX for an unbounded buffer length, so 
the cast to int here in the original code is correct.  The type of 
interest is not of the passed size, but rather the return value of the 
function.   The changelog is wrong: if sizeof(size_t) > sizeof(int) then 
the return value overflows.

> > -	if (WARN_ON_ONCE((int) size < 0))
> > +	if (WARN_ON_ONCE((ssize_t) size < 0))
> >  		return 0;
> >  
> >  	str = buf;

Re: [PATCH] lib: vsprintf: fix invalid arg check

[Vasiliy Kulikov]

On Wed, Nov 10, 2010 at 13:38 -0800, David Rientjes wrote:
> On Wed, 10 Nov 2010, Andrew Morton wrote:
> 
> > > "size" is size_t.  If we want to check whether it was underflowed
> > > then we should cast it to ssize_t instead of int.  When
> > > sizeof(size_t) > sizeof(int) the code sees UINT_MAX as underflow,
> > > but it is not.
> > > 
> > 
> > Does this patch fix any actual observed problem?

I don't think so, this fix is more theoretical than practical.
However, maybe there is some crazy driver that fills array of 2GB with
s*printf().

> > >  Compile tested.
> > > 
> > 
> > I guess not.

What do you mean here? 

$ make lib/vsprintf.o
  CHK     include/linux/version.h
  CHK     include/generated/utsrelease.h
  CALL    scripts/checksyscalls.sh
  CC      lib/vsprintf.o

Compiled without warnings.

> > >  	/* Reject out-of-range values early.  Large positive sizes are
> > >  	   used for unknown buffer sizes. */
> > 
> > Thousands of people would find that comment to be utterly mysterious. 
> > I am one.
> > 
[...]
> The changelog is wrong: if sizeof(size_t) > sizeof(int) then the return value overflows.

This comparison is intended for size_t _underflow_, e.g. in such (buggy)
code:

len = snprintf(buf, sizeof(buf), "%s", string);
len += snprintf(buf + len, sizeof(buf) - len, "%s", string2);

If the first snprintf() returns len that is greater than sizeof(buf),
then sizeof(buf)-len is negative; casted to (unsigned!) size_t it
becomes some big value. buf+len points to somewhere after the real buf.

To detect this situation we check whether size is negative (as signed).
But it should be checked as integer of the same size.

> vsprintf() and sprintf() pass INT_MAX for an unbounded buffer length

OK, this should be changed to LONG_MAX.


> The type of interest is not of the passed size, but rather the return value of
> the function.

>From vsnprintf comment:

 * The return value is the number of characters which would
 * be generated for the given input, excluding the trailing

If nothing was filled then result is zero.

> 
> > > -	if (WARN_ON_ONCE((int) size < 0))
> > > +	if (WARN_ON_ONCE((ssize_t) size < 0))
> > >  		return 0;
> > >  
> > >  	str = buf;


-- 
Vasiliy

Re: [PATCH] lib: vsprintf: fix invalid arg check

[David Rientjes]

On Thu, 11 Nov 2010, Vasiliy Kulikov wrote:

> > > > "size" is size_t.  If we want to check whether it was underflowed
> > > > then we should cast it to ssize_t instead of int.  When
> > > > sizeof(size_t) > sizeof(int) the code sees UINT_MAX as underflow,
> > > > but it is not.
> > > > 
> > > 
> > > Does this patch fix any actual observed problem?
> 
> I don't think so, this fix is more theoretical than practical.
> However, maybe there is some crazy driver that fills array of 2GB with
> s*printf().
> 

All sizes passed to vsprintf() greater than INT_MAX are invalid; that's 
what the original code is testing, warning, and handling correctly.

> > > >  Compile tested.
> > > > 
> > > 
> > > I guess not.
> 
> What do you mean here? 
> 
> $ make lib/vsprintf.o
>   CHK     include/linux/version.h
>   CHK     include/generated/utsrelease.h
>   CALL    scripts/checksyscalls.sh
>   CC      lib/vsprintf.o
> 
> Compiled without warnings.
> 

Andrew was commenting that this was the only additional information you 
provided instead of showing a working example.

> > > >  	/* Reject out-of-range values early.  Large positive sizes are
> > > >  	   used for unknown buffer sizes. */
> > > 
> > > Thousands of people would find that comment to be utterly mysterious. 
> > > I am one.
> > > 
> [...]
> > The changelog is wrong: if sizeof(size_t) > sizeof(int) then the return value overflows.
> 
> This comparison is intended for size_t _underflow_, e.g. in such (buggy)
> code:
> 
> len = snprintf(buf, sizeof(buf), "%s", string);
> len += snprintf(buf + len, sizeof(buf) - len, "%s", string2);
> 

That's buggy because len may be greater than sizeof(buf).  snprintf() 
returns the number of characters that would have been generated if it 
wasn't truncated so that we can test that value upon return.

> If the first snprintf() returns len that is greater than sizeof(buf),
> then sizeof(buf)-len is negative; casted to (unsigned!) size_t it
> becomes some big value. buf+len points to somewhere after the real buf.
> 

Right, that's the behavior of snprintf(), but that doesn't mean the passed 
size can be anything larger than INT_MAX.

> To detect this situation we check whether size is negative (as signed).
> But it should be checked as integer of the same size.
> 
> > vsprintf() and sprintf() pass INT_MAX for an unbounded buffer length
> 
> OK, this should be changed to LONG_MAX.
> 

No, it shouldn't, these functions return int.  INT_MAX is the largest 
value we can handle successfully and that's why it is the special case for 
sprintf() and vsprintf().

The code as it stands is correct not because of the type of the size but 
rather the type of the return value.

Re: [PATCH] lib: vsprintf: fix invalid arg check

[Vasiliy Kulikov]

On Thu, Nov 11, 2010 at 12:38 -0800, David Rientjes wrote:
> On Thu, 11 Nov 2010, Vasiliy Kulikov wrote:
> 
> > > > > "size" is size_t.  If we want to check whether it was underflowed
> > > > > then we should cast it to ssize_t instead of int.  When
> > > > > sizeof(size_t) > sizeof(int) the code sees UINT_MAX as underflow,
> > > > > but it is not.
> > > > > 
> > > > 
> > > > Does this patch fix any actual observed problem?
> > 
> > I don't think so, this fix is more theoretical than practical.
> > However, maybe there is some crazy driver that fills array of 2GB with
> > s*printf().
> > 
> 
> All sizes passed to vsprintf() greater than INT_MAX are invalid; that's 
> what the original code is testing, warning, and handling correctly.

Not always correctly:

(int)(0xFFFFFFFFL + 2) = 1 is positive.

> No, it shouldn't, these functions return int.  INT_MAX is the largest 
> value we can handle successfully and that's why it is the special case for 
> sprintf() and vsprintf().
> 
> The code as it stands is correct not because of the type of the size but 
> rather the type of the return value.

OK, if the main reason here is return value type, then the correct
handling should be:

	/* Reject out-of-range values early.  Large positive sizes are
	   used for unknown buffer sizes. */
-	if (WARN_ON_ONCE((int) size < 0))
+	if (WARN_ON_ONCE(size > INT_MAX)
		return 0;

This should catch all underflows and too big integers.

-- 
Vasiliy

Re: [PATCH] lib: vsprintf: fix invalid arg check

[David Rientjes]

On Fri, 12 Nov 2010, Vasiliy Kulikov wrote:

> OK, if the main reason here is return value type, then the correct
> handling should be:
> 
> 	/* Reject out-of-range values early.  Large positive sizes are
> 	   used for unknown buffer sizes. */
> -	if (WARN_ON_ONCE((int) size < 0))
> +	if (WARN_ON_ONCE(size > INT_MAX)
> 		return 0;
> 
> This should catch all underflows and too big integers.
> 

That is equivalent since size_t is always unsigned; if you'd like to 
change it, it should be presented only as a style change.  More important 
would be writing a less cryptic comment :)

Re: [PATCH] lib: vsprintf: fix invalid arg check

[Vasiliy Kulikov]

On Thu, Nov 11, 2010 at 13:34 -0800, David Rientjes wrote:
> On Fri, 12 Nov 2010, Vasiliy Kulikov wrote:
> > OK, if the main reason here is return value type, then the correct
> > handling should be:
> > 
> > 	/* Reject out-of-range values early.  Large positive sizes are
> > 	   used for unknown buffer sizes. */
> > -	if (WARN_ON_ONCE((int) size < 0))
> > +	if (WARN_ON_ONCE(size > INT_MAX)
> > 		return 0;
> > 
> > This should catch all underflows and too big integers.
> > 
> 
> That is equivalent since size_t is always unsigned;

Not equivalent:

void test_size(size_t size)
{
    char buffer[128];
    sprintf(buffer, "size %lx is BAD", size);
    snprintf(buffer, size, "size %lx is OK", size);
    pr_info("%s\n", buffer);
    if (size > INT_MAX)
        pr_info("%lx is catched by (size) > INT_MAX", size);
}

static int init(void) {
        test_size(0x7FFFFFFF);
        test_size(0x80000000);
        test_size(0x80000001);
        test_size(0xFFFFFFFF);
        test_size(0x100000000);
        test_size(0x100000001);
        test_size(0x17fffffff);
        test_size(0x180000000);
        test_size(0x180000001);

        return 0;
}


Output on x86_64:

[12486.542047] size 7fffffff is OK
[12486.542051] size 80000000 is BAD
[12486.542053] 80000000 is catched by (size) > INT_MAX
[12486.542055] size 80000001 is BAD
[12486.542057] 80000001 is catched by (size) > INT_MAX
[12486.542059] size ffffffff is BAD
[12486.542061] ffffffff is catched by (size) > INT_MAX
[12486.542063] size 100000000 is OK
[12486.542065] 100000000 is catched by (size) > INT_MAX
[12486.542067] size 100000001 is OK
[12486.542069] 100000001 is catched by (size) > INT_MAX
[12486.542071] size 17fffffff is OK
[12486.542073] 17fffffff is catched by (size) > INT_MAX
[12486.542075] size 180000000 is BAD
[12486.542077] 180000000 is catched by (size) > INT_MAX
[12486.542079] size 180000001 is BAD
[12486.542081] 180000001 is catched by (size) > INT_MAX


-- 
Vasiliy